prometei_elf | d58a3e41df025b7cffcdb2d506a461d2dd017852edaf346ccb061092d2b85caa

Analysis

max time kernel
5s
max time network
144s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240729-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240729-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
04/04/2025, 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

na.elf
Size

425KB
MD5

fdacb5c0b076523cda43e97101d775ca
SHA1

7cf1724597a99a1081fa250073c780ff827a2216
SHA256

d58a3e41df025b7cffcdb2d506a461d2dd017852edaf346ccb061092d2b85caa
SHA512

8dc803b1982394133dc9052398b1e324c98377885ab4ff37401ccee2013cfee40808f6cdee544d5eab0f77168d17883ea089339cb4efb91d537eef3ab91f0389
SSDEEP

6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitg5:25WOSACZSV6eKRH5EPiamb4DsDwwcp

Score

10^/10

prometei_elf botnet discovery miner persistence privilege_escalation stealer upx

Malware Config

Signatures

Prometei
Prometei is a multiplatform botnet used to mine cryptocurrency.
botnet miner prometei_elf
Prometei_elf family
prometei_elf

Deletes itself 1 IoCs

pid	Process
1402	na.elf

Modifies hosts file 1 IoCs

Adds to hosts file used for mapping hosts to IP addresses.

description	ioc	Process
File opened for modification	/etc/hosts	na.elf

Reads EFI boot settings 1 TTPs 3 IoCs

Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

stealer

Bootkit

T1542.003

description	ioc	Process
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/lib/systemd/system/uplugplay.service	na.elf

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/sbin/uplugplay	na.elf

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-1.dat	upx

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/172/cmdline	pgrep
File opened for reading	/proc/92/cmdline	pidof
File opened for reading	/proc/82/status	pgrep
File opened for reading	/proc/1334/stat	pidof
File opened for reading	/proc/22/stat	pidof
File opened for reading	/proc/633/stat	pidof
File opened for reading	/proc/1024/cmdline	pidof
File opened for reading	/proc/8/status	pgrep
File opened for reading	/proc/1107/stat	pidof
File opened for reading	/proc/483/status	pgrep
File opened for reading	/proc/921/status	pgrep
File opened for reading	/proc/964/status	pgrep
File opened for reading	/proc/87/status	pgrep
File opened for reading	/proc/1409/cmdline	pgrep
File opened for reading	/proc/169/cmdline	pidof
File opened for reading	/proc/201/cmdline	pgrep
File opened for reading	/proc/873/cmdline	pidof
File opened for reading	/proc/873/cmdline	pgrep
File opened for reading	/proc/825/status	pgrep
File opened for reading	/proc/1019/cmdline	pgrep
File opened for reading	/proc/3/stat	pidof
File opened for reading	/proc/76/cmdline	pidof
File opened for reading	/proc/1107/status	pgrep
File opened for reading	/proc/73/stat	pidof
File opened for reading	/proc/806/cmdline	pidof
File opened for reading	/proc/91/status	pgrep
File opened for reading	/proc/1400/status	pgrep
File opened for reading	/proc/91/stat	pidof
File opened for reading	/proc/494/stat	pidof
File opened for reading	/proc/950/stat	pidof
File opened for reading	/proc/70/status	pgrep
File opened for reading	/proc/1409/status	pgrep
File opened for reading	/proc/806/cmdline	pgrep
File opened for reading	/proc/1072/cmdline	pidof
File opened for reading	/proc/1204/status	pgrep
File opened for reading	/proc/79/cmdline	pidof
File opened for reading	/proc/1103/cmdline	pidof
File opened for reading	/proc/858/status	pgrep
File opened for reading	/proc/77/status	pgrep
File opened for reading	/proc/1041/cmdline	pgrep
File opened for reading	/proc/452/cmdline	pidof
File opened for reading	/proc/264/status	pgrep
File opened for reading	/proc/168/cmdline	pidof
File opened for reading	/proc/82/cmdline	pidof
File opened for reading	/proc/671/stat	pidof
File opened for reading	/proc/574/status	pgrep
File opened for reading	/proc/140/stat	pidof
File opened for reading	/proc/1178/cmdline	pidof
File opened for reading	/proc/1339/stat	pidof
File opened for reading	/proc/70/status	pgrep
File opened for reading	/proc/825/status	pgrep
File opened for reading	/proc/1096/cmdline	pgrep
File opened for reading	/proc/1339/cmdline	pgrep
File opened for reading	/proc/9/cmdline	pgrep
File opened for reading	/proc/90/cmdline	pgrep
File opened for reading	/proc/520/cmdline	pgrep
File opened for reading	/proc/1372/cmdline	pgrep
File opened for reading	/proc/78/status	pgrep
File opened for reading	/proc/806/cmdline	pgrep
File opened for reading	/proc/1074/cmdline	pgrep
File opened for reading	/proc/1060/cmdline	pgrep
File opened for reading	/proc/1060/cmdline	pidof
File opened for reading	/proc/1073/status	pgrep
File opened for reading	/proc/1103/status	pgrep

/tmp/na.elf
/tmp/na.elf
1⤵
- Deletes itself
- Modifies hosts file
- Modifies systemd
- Write file to user bin folder
PID:1402
- /bin/sh
  sh -c "pgrep na.elf"
  2⤵
  PID:1405
- - /usr/bin/pgrep
    pgrep na.elf
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1406
- /bin/sh
  sh -c "pgrep uplugplay"
  2⤵
  PID:1409
- - /usr/bin/pgrep
    pgrep uplugplay
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1410
- /bin/sh
  sh -c "pidof uplugplay"
  2⤵
  PID:1452
- - /usr/bin/pidof
    pidof uplugplay
    3⤵
    - Reads runtime system information
    PID:1453
- /bin/sh
  sh -c "pgrep upnpsetup"
  2⤵
  PID:1456
- - /usr/bin/pgrep
    pgrep upnpsetup
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1457
- /bin/sh
  sh -c "pidof upnpsetup"
  2⤵
  PID:1460
- - /usr/bin/pidof
    pidof upnpsetup
    3⤵
    - Reads runtime system information
    PID:1461
- /bin/sh
  sh -c "systemctl daemon-reload"
  2⤵
  PID:1463
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads EFI boot settings
    PID:1464
- /bin/sh
  sh -c "systemctl enable uplugplay.service"
  2⤵
  PID:1490
- - /usr/bin/systemctl
    systemctl enable uplugplay.service
    3⤵
    - Reads EFI boot settings
    PID:1491
- /bin/sh
  sh -c "systemctl start uplugplay.service"
  2⤵
  PID:1533
- - /usr/bin/systemctl
    systemctl start uplugplay.service
    3⤵
    - Reads EFI boot settings
    PID:1534

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/usr/lib/systemd/system/uplugplay.service

Filesize
145B

MD5
8ca62d1f47880bce036c2956c9b7b272

SHA1
3bcc3a5c4fcc5b0d08c4524a59f6b8e113b62060

SHA256
c655d3d4e374fad38313ec4262207b2d7d68a870238f203ef3c33f85e66c8e32

SHA512
4cd2d9d67151fa25e833707dee2442c4a5f752053fc2c36ec73c0e2b734c66ca69c63fceb47714d9add5b9fe2eee1e45be5199e2cae7c26173e766b333877da6

Download Submit
/usr/sbin/uplugplay

Filesize
425KB

MD5
fdacb5c0b076523cda43e97101d775ca

SHA1
7cf1724597a99a1081fa250073c780ff827a2216

SHA256
d58a3e41df025b7cffcdb2d506a461d2dd017852edaf346ccb061092d2b85caa

SHA512
8dc803b1982394133dc9052398b1e324c98377885ab4ff37401ccee2013cfee40808f6cdee544d5eab0f77168d17883ea089339cb4efb91d537eef3ab91f0389

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads